CVE-2025-67940: 
WordPress vulnerability analysis and mitigation

CVE-2025-67940 is a PHP Local File Inclusion (LFI) vulnerability in the Mikado-Themes Powerlift WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all Powerlift theme versions prior to 3.2.1 and was reported by researcher Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on October 28, 2025, with public disclosure by Patchstack on January 16, 2026. The CVE was officially published on January 22, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assigned by CISA-ADP (Patchstack, NVD).

The vulnerability stems from improper validation of user-supplied input used in PHP include or require statements within the Powerlift theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server, enabling Local File Inclusion (LFI). The attack vector is network-accessible, requires no authentication or user privileges, but has high attack complexity. No technical write-up or public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive files such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. The vulnerability carries high impacts to confidentiality, integrity, and availability, meaning an attacker could read sensitive data, modify server-side content, or disrupt service availability. Depending on server configuration, LFI may also be chained with log poisoning or other techniques to achieve remote code execution (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class and severity are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The primary remediation is to update the Powerlift WordPress theme to version 3.2.1 or later, which contains the fix for this vulnerability. As an interim measure, Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until the theme is updated. Additionally, administrators should implement a Web Application Firewall (WAF) to detect and block suspicious file inclusion requests, audit server logs for anomalous file access patterns, and ensure user-supplied input is never passed unsanitized to PHP file inclusion functions (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability intelligence report covering January 12–18, 2026, highlighting it as a notable theme-level LFI issue. Patchstack, the assigning CNA, classified it as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress installations (Wordfence, Patchstack).